Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If someone who knows about the BSD project has a moment to answer this, I'm wondering a few things about the encryption used. It's more than what I'm finding in the docs and on Wiki/Google (even the OpenBSD crypto page didn't seem to cover this):

1) Is disk encryption (TrueCrypt or whatever BSD is using, I know it varies but let's say in general) considered involved with the password hashing? Or is it more like the /etc/shadow file just has the hashed passwords that are run through something like SHA-3 or...? It seems like supervisor mode just switches between root and user with the each password (root or from users) being stored in that shadow file. But is the system itself (like logging on) not protected by disk encryption? TLDR: Is the hashing in protecting passwords the only protection used to protect the system from someone accessing the info needed to get into a root (or admin user account) or is there someone kind of logon disk encryption as well that would protect everything (like if the disk were taken out and switched to another box)?

2) Would the networking-related functionality like in OpenSSH be considered part of the encryption used in BSD or is that generally considered more of "available to any OS and not really a benefit to a specific OS such as BSD"? Or is there something in BSD that allows for higher protection in network encryption or in allowing it to be done faster than other OS's?

3) Does BSD use any encryption algos that take advantage of the particular design of its monolithic kernel? Like, something like AES-256 that might be slower (vs AES-128 which is faster but slightly 'not as secure') to run somewhere else (not this exactly but just an example)?

Even if someone can just point me in the right direction on where to get these answers, that would be helpful as well (as I'm not seeing it on searches).

share|improve this question

closed as too broad by Xander, Steve, Eric G, schroeder, TildalWave May 15 '14 at 20:10

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

Why not divide your currently very very broad question into several more specific questions so we could answer them more easily (from hard-disk encryption to network protocol through cryptographic algorithm performance and so on...). :) – WhiteWinterWolf Nov 12 '13 at 16:43
I hope they don't use sha3 – Lucas Kauffman Nov 12 '13 at 17:00